Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-57228 | critical | 9.1 | No | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.... | 2026-09-29 |
| CVE-2026-94622 | high | 7.5 | No | vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggre... | 2026-09-29 |
| CVE-2026-94623 | high | 7.5 | No | vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly... | 2026-09-29 |
| CVE-2026-94624 | high | 7.5 | No | vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOfflo... | 2026-09-29 |
| CVE-2026-94625 | medium | 5.3 | No | vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless trans... | 2026-09-29 |
| CVE-2026-94626 | high | 7.5 | No | vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attack... | 2026-09-29 |
| CVE-2026-94627 | high | 7.5 | No | vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single t... | 2026-09-29 |
| CVE-2026-68843 | medium | 5.5 | No | Use after free in Microsoft Office Word allows an authorized attacker to disclose information locally. | 2026-09-29 |
| CVE-2026-91043 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on... | 2026-09-29 |
| CVE-2026-102261 | medium | 5.4 | No | A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/med... | 2026-09-29 |
| CVE-2026-97647 | medium | 5.3 | No | A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impa... | 2026-09-29 |
| CVE-2026-97365 | medium | 6.3 | No | A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.... | 2026-09-29 |
| CVE-2026-97322 | medium | 4.3 | No | A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-inf... | 2026-09-29 |
| CVE-2026-87799 | critical | 9.9 | No | Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on... | 2026-09-29 |
| CVE-2026-88771 | critical | 9.8 | Listed | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, be... | 2026-09-29 |
| CVE-2026-85526 | critical | 9.9 | No | Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation priv... | 2026-09-29 |
| CVE-2026-82384 | critical | 9.8 | No | Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-cont... | 2026-09-29 |
| CVE-2026-81473 | high | 8.1 | No | Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with... | 2026-09-29 |
| CVE-2026-77320 | medium | 5.3 | No | TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments,... | 2026-09-29 |
| CVE-2026-72668 | high | 7.3 | No | Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrativ... | 2026-09-29 |